Disconnected credential validation using pre-fetched service tickets

BACKGROUND OF THE INVENTION

p-00021. Field of the Invention

p-0003The present invention relates to computer network authentication services. Specifically, the invention relates to apparatus, methods, and systems for providing disconnected validation of login credentials.

p-00042. Description of the Related Art

p-0005In recent years, computer networks have been increasingly significant in terms of the quantity and sensitivity of the data communicated. Once used primarily for academic purposes, the Internet has become a vehicle for communicating such confidential information as credit card transactions, bank account transactions, and corporate intellectual property. The same applies to proprietary corporate networks. As the quantity and value of the data being communicated has increased, the threats to the security of this data have increased proportionately.

p-0006One of the technologies developed to address data security threats is Kerberos authentication. Kerberos provides a means for secure authentication of a user's credentials as well as means to protect sensitive data communicated across an insecure network. Kerberos authentication relies on the existence of a Kerberos server that certifies a user's identity to network services utilized by an application the user is running. Services that use Kerberos to authenticate users are said to be “Kerberized.”

p-0007While the need for security has increased, so has the need for flexibility. Users are increasingly mobile and may access network services through a variety of locations and devices. Networks are increasing in size and complexity and are often in a state of flux and change. Such size and flexibility provides challenges to network security and reliability. For example, changes in policy or accounts must be effected across larger networks and a greater number of devices. Furthermore, an authentication server such as a Kerberos server may be temporarily inaccessible to some or all of a network resulting in a need for “disconnected” authentication of a user.

p-0008While various solutions for disconnected authentication have been developed, such solutions typically require at least one previous login by the user at a particular device at a time that the authentication server is accessible. Such a requirement is impractical given the sheer number of networked devices and the frequency of changes in network configuration and login accounts.

p-0009Given the issues and challenges related to providing authentication services and the shortcomings of currently available solutions, a need exists for an apparatus, method, and system to validate login credentials of a user or group member without requiring a previous login from a particular device or immediate access to an authentication server.

SUMMARY OF THE INVENTION

p-0010The present invention has been developed in response to the present state of the art, and in particular, in response to the problems and needs in the art that have not yet been fully solved by currently available authentication systems. Accordingly, the present invention has been developed to provide an apparatus, method, and system to validate login credentials without requiring a previous login via the login device or immediate access to an authentication server.

p-0011In one aspect of the present invention, a method to validate login credentials of a selected party includes authenticating a login device with an authentication service, obtaining a service ticket from the authentication service for the login device to communicate with the selected party (referred to herein as a user service ticket), and storing the user service ticket for subsequent authentication of the selected party by the login device. Authenticating the login device may include providing valid credentials and a valid timestamp to the authentication service. Tickets to communicate with one or more selected parties such as users or group members may be pre-fetched by the login device without requiring access to the credentials of the users or group members.

p-0012In another aspect of the present invention, an apparatus to validate login credentials includes a ticket pre-fetch module configured to authenticate a login device with an authentication service and obtain (i.e. pre-fetch) user service tickets from the authentication service for the login device to communicate with one or more selected parties such as users and group members. The apparatus may also include a ticket cache configured to store the pre-fetched tickets for subsequent authentication of the selected parties by the login device.

p-0013In certain embodiments, the apparatus also includes an authentication module configured to authenticate login credentials against pre-fetched tickets stored in the ticket cache. Login credentials may be received and validated by the authentication module despite unavailability of an authentication service. In certain embodiments, authenticating login credentials against a pre-fetched user service ticket includes generating a key from the login credentials and decrypting a portion of the pre-fetched user service ticket using the generated key. Furthermore, authentication data within the pre-fetched user service ticket may be compared with known data to confirm the validity of the pre-fetched user service ticket. In one embodiment, authenticating a party against a pre-fetched user service ticket may occur by using a pre-fetched user service ticket corresponding to the selected party to construct a Kerberos AP-REQ message structure and invoking a validation function that processes the Kerberos AP-REQ message structure.

p-0014In one embodiment, a list of users and/or groups is retrieved from a known source such as a configuration file and user service tickets to communicate with each user and group member are pre-fetched and stored in the ticket cache associated with the login device. The pre-fetched user service tickets may also be refreshed within the ticket cache as need by obtaining new user service tickets from the authentication service. Refreshing the user service tickets may keep the ticket cache better synchronized with changes in user credentials registered with the authentication server. In one embodiment, pre-fetched user service tickets may be refreshed in response to selected events such as expiration of a selected interval, a login request, a change in user credentials, and a reboot cycle.

p-0015In another aspect of the present invention, a system to validate login credentials includes an authentication server configured to provide an authentication service, and a login device comprising the ticket pre-fetch module, the authentication module, and the ticket cache previously described. The authentication server may be a domain controller. In one embodiment, the authentication server is a Kerberos key distribution center (KDC) and the pre-fetched user service tickets may be Kerberos service tickets.

p-0016The present invention advantageously facilitates disconnected authentication of login credentials without requiring a previous login session. It should be noted that reference throughout this specification to features, advantages, or similar language does not imply that all of the features and advantages that may be realized with the present invention should be or are in any single embodiment of the invention. Rather, language referring to the features and advantages is understood to mean that a specific feature, advantage, or characteristic described in connection with an embodiment is included in at least one embodiment of the present invention. Thus, discussion of the features and advantages, and similar language, throughout this specification may, but do not necessarily, refer to the same embodiment.

p-0017Furthermore, the described features, advantages, and characteristics of the invention may be combined in any suitable manner in one or more embodiments. One skilled in the relevant art will recognize that the invention can be practiced without one or more of the specific features or advantages of a particular embodiment. In other instances, additional features and advantages may be recognized in certain embodiments that may not be present in all embodiments of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

p-0018In order that the advantages of the invention will be readily understood, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments that are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments of the invention and are not therefore to be considered to be limiting of its scope, the invention will be described and explained with additional specificity and detail through the use of the accompanying drawings, in which:

p-0019<figref idrefs="DRAWINGS">FIG. 1</figref> is a block diagram illustrating a typical prior art authentication system;

p-0020<figref idrefs="DRAWINGS">FIG. 2</figref> is a block diagram illustrating a typical prior art service ticket;

p-0021<figref idrefs="DRAWINGS">FIG. 3</figref> is a block diagram illustrating a credential validation system of the present invention;

p-0022<figref idrefs="DRAWINGS">FIG. 4</figref> is a flow chart diagram illustrating one embodiment of a ticket fetching method of the present invention;

p-0023<figref idrefs="DRAWINGS">FIG. 5</figref> is a block diagram illustrating a user service ticket of the present invention; and

p-0024<figref idrefs="DRAWINGS">FIG. 6</figref> is a flow chart diagram illustrating a credential validation method of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

p-0025It will be readily understood that the components of the present invention, as generally described and illustrated in the Figures herein, may be arranged and designed in a wide variety of different configurations. Thus, the following more detailed description of the embodiments of the apparatus, method, and system of the present invention, as represented in <figref idrefs="DRAWINGS">FIGS. 3 through 6</figref>, is not intended to limit the scope of the invention, as claimed, but is merely representative of selected embodiments of the invention.

p-0026Many of the functional units described in this specification have been labeled as modules, in order to more particularly emphasize their implementation independence. For example, a module may be implemented as a hardware circuit comprising custom VLSI circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. A module may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices or the like.

p-0027Modules may also be implemented in software for execution by various types of processors. An identified module of executable code may, for instance, comprise one or more physical or logical blocks of computer instructions which may, for instance, be organized as an object, procedure, or function. Nevertheless, the executables of an identified module need not be physically located together, but may comprise disparate instructions stored in different locations which, when joined logically together, comprise the module and achieve the stated purpose for the module. Executables of identified modules may be stored on any form of computer-readable storage media, such as magnetic disc or tape, optical disk, flash memory, or the like.

p-0028Indeed, a module of executable code could be a single instruction, or many instructions, and may even be distributed over several different code segments, among different programs, and across several memory devices. Similarly, operational data may be identified and illustrated herein within modules, and may be embodied in any suitable form and organized within any suitable type of data structure. The operational data may be collected as a single data set, or may be distributed over different locations including over different storage devices, and may exist, at least partially, merely as electronic signals on a system or network.

p-0029In the following description, numerous specific details are provided, such as examples of programming, software modules, user selections, network transactions, database queries, database structures, hardware modules, hardware circuits, hardware chips, etc., to provide a thorough understanding of embodiments of the invention. One skilled in the relevant art will recognize, however, that the invention can be practiced without one or more of the specific details, or with other methods, components, materials, and so forth. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the invention.

p-0030The features, structures, or characteristics of the invention described throughout this specification may be combined in any suitable manner in one or more embodiments. For example, reference throughout this specification to “one embodiment,” “an embodiment,” or similar language means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases “in one embodiment,” “in an embodiment,” or similar language throughout this specification do not necessarily all refer to the same embodiment and the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

p-0031The present invention sets forth an apparatus, system and method to validate credentials provided to a login device without requiring immediate connectivity to an authentication server or a previous login on the login device.

p-0032<figref idrefs="DRAWINGS">FIG. 1</figref> is a block diagram illustrating a typical prior art authentication system <b>100</b>. As depicted, the authentication system <b>100</b> includes a user <b>105</b>, a client <b>110</b>, an application server <b>120</b>, an authentication server <b>130</b>, and a service provider <b>140</b>. The authentication system <b>100</b> facilitates providing applications and services to the user <b>105</b> in a secure manner.

p-0033The application server <b>120</b> may include a login service <b>150</b> with an authentication module <b>160</b>. In the depicted embodiment, the application server <b>120</b> is configured to facilitate authentication of users and group members. In one embodiment, the authentication module <b>160</b> is a pluggable authentication module. The authentication module may receive one or more credentials such as a username and password from the user <b>105</b> via the client <b>110</b>. Alternately, the user <b>105</b> may be stationed at the application server <b>120</b> and directly provide the credentials <b>112</b> to the login service <b>150</b> and the authentication module <b>160</b>.

p-0034In response to the received credentials <b>112</b>, the authentication module <b>160</b> may provide an authentication request <b>162</b> to the authentication server <b>130</b>. In one embodiment, the authentication server <b>130</b> is a Kerberos server that may function as a domain controller such as a Windows™ domain controller. In the depicted embodiment, the authentication server <b>130</b> includes an authentication service <b>170</b>, and a ticket granting service <b>180</b>.

p-0035The authentication service <b>170</b> may receive the authentication request <b>162</b>, for example a Kerberos AS_REQ message, and provide an authentication reply <b>172</b> such as a Kerberos AS_REP message. In response, the authentication module <b>160</b> may use the authentication reply <b>172</b> to determine the authenticity of the user provided credentials <b>112</b>. In one embodiment, the authentication module <b>160</b> derives a key (not shown) from the credentials <b>112</b> which is used to decrypt a portion of the AS_REP message. If the decryption is successful, the credentials <b>112</b> provided by the user <b>105</b> are known to be valid.

p-0036In response to successful validation, the application server <b>120</b> may generate a service ticket request <b>164</b> and receive a ticket reply <b>182</b> from the ticket granting service <b>180</b> running on the authentication server <b>130</b>. In certain embodiments, the ticket reply <b>182</b> includes a service ticket <b>192</b> to be presented to a particular service provider <b>140</b>. Specifically, the service ticket <b>192</b> may enable a user or group member to request services of the service provider <b>140</b>. In response, to proper presentation of the service ticket <b>192</b>, the service provider <b>140</b> and the application server <b>120</b> may securely exchange service data <b>194</b>.

p-0037<figref idrefs="DRAWINGS">FIG. 2</figref> is a block diagram illustrating a typical prior art service ticket <b>200</b>. The prior art service ticket <b>200</b> is one example of the service ticket <b>192</b> used in the prior art authentication system <b>100</b>. The service ticket <b>200</b> ensures that user indicated by the ‘principal name’ field <b>220</b> and the service indicated by the ‘service name’ field <b>230</b> are authentic and may safely exchange service data. In the depicted embodiment, the service ticket <b>200</b> is a Kerberos service ticket, the ‘principal name’ field <b>220</b> references a user name <b>225</b> (i.e. “User1” in the depicted example) and the ‘service name’ field <b>230</b> references a service provider name <b>235</b> (“NetworkService1” in the depicted example).

p-0038<figref idrefs="DRAWINGS">FIG. 3</figref> is a block diagram illustrating a credential validation system <b>300</b> of the present invention. In addition to many of the elements of the prior art authentication system <b>100</b>, the credential validation system <b>300</b> may include a login service <b>310</b>. The depicted elements or similar elements function cooperatively to enable disconnected authentication of a user <b>105</b> without requiring a previous login by the user <b>105</b>.

p-0039The depicted login service <b>310</b> includes a ticket pre-fetch module <b>320</b>, an authentication module <b>330</b>, a ticket cache <b>340</b>, and a configuration file <b>350</b>. Rather than obtaining service tickets for a user to communicate with a service provider as commonly done in the prior art, the ticket pre-fetch module <b>320</b> may pre-fetch one or more user service tickets (not shown) for a login device <b>110</b> or <b>120</b> to communicate with particular users or group members. In one embodiment, the ticket pre-fetch module <b>320</b> retrieves a pre-fetch list (not shown) from a known source such as the configuration file <b>350</b> and obtains user service tickets for the login device <b>120</b> to communicate with the users and group members referenced in the pre-fetch list.

p-0040It should be noted that the phrase “user service ticket” as used herein and subsequently shown in <figref idrefs="DRAWINGS">FIG. 5</figref>, refers to a service ticket for a login device to conduct communication with, or receive services from, a particular user. This contrasts with the prior art practice of obtaining service tickets for a user to communicate with a service provider or server.

p-0041The ticket pre-fetch module <b>320</b> may store the pre-fetched user service tickets (not shown) within the ticket cache <b>340</b>. The pre-fetched user service tickets may also be refreshed within the ticket cache as need by obtaining a new user service tickets from the authentication service. In one embodiment, pre-fetched tickets are refreshed in response to selected events such as expiration of a selected interval, a login request, and a reboot cycle.

p-0042In response to a login request, the authentication module <b>330</b> may access the ticket cache <b>340</b> and authenticate a user or group member against a pre-fetched user service ticket—particularly if the authentication server <b>130</b> is unavailable or inaccessible. <figref idrefs="DRAWINGS">FIGS. 4</figref> thru <b>6</b> provide more detailed information regarding pre-fetching user service tickets issued to the login device to communicate with the user and the process of authenticating users against pre-fetched service tickets.

p-0043<figref idrefs="DRAWINGS">FIG. 4</figref> is a flow chart diagram illustrating one embodiment of a ticket fetching method <b>400</b> of the present invention. As depicted, the ticket fetching method <b>400</b> include authenticating <b>410</b> a login device, retrieving <b>420</b> a pre-fetch list or the like, obtaining <b>430</b> one or more pre-fetched user service tickets, and storing <b>440</b> the pre-fetched user service tickets for subsequent validation of login credentials. The ticket fetching method <b>400</b> may be conducted in response to an event such as expiration of polling interval, execution of a reboot cycle, a login request, or similar event.

p-0044Authenticating <b>410</b> a login device may include sending an authentication request <b>162</b> (see <figref idrefs="DRAWINGS">FIG. 3</figref>) to request authentication of the login device <b>110</b> or <b>120</b> rather than the user <b>105</b>. Subsequently, an authentication reply <b>172</b> may be used to authenticate the login credentials of the login device <b>110</b> or <b>120</b>. Retrieving <b>420</b> a pre-fetch list or the like may include obtaining and/or referencing a list of users or group members for whom user service tickets should be pre-fetched. One of skill in the art will appreciate that the methods depicted herein need not be conducted in the depicted order. For example, retrieving <b>420</b> a pre-fetch list may occur previous to authenticating <b>410</b> a login device.

p-0045Obtaining <b>430</b> one or more pre-fetched user service tickets may include sending one or more ticket requests <b>164</b> for the login device <b>110</b> or <b>120</b> to communicate with each user or group member and receiving a ticket reply <b>182</b> for each user or group member with a user service ticket encapsulated therein. Storing <b>440</b> the pre-fetched user service tickets for subsequent validation login credentials may include storing the pre-fetched user service tickets in the ticket cache <b>340</b>.

p-0046<figref idrefs="DRAWINGS">FIG. 5</figref> is a block diagram illustrating a user service ticket <b>500</b> of the present invention. Although the user service ticket <b>500</b> may be identical in format to the service ticket <b>200</b> depicted in <figref idrefs="DRAWINGS">FIG. 2</figref>, the fields may be used differently to facilitate disconnected authentication. Specifically, the ‘principal name’ field <b>520</b> may reference a login device name <b>525</b> rather than a user name, and the ‘service name’ field <b>530</b> may reference a user or group member name <b>535</b> rather than the name of a service provider. For example, the depicted user service ticket <b>500</b> enables the login device “MyLoginDevice” to request services of and communicate with the user “User1”. The depicted user service ticket <b>500</b> may be pre-fetched before a need for authentication has arisen and stored in the ticket cache <b>340</b> to facilitate authentication of the login credentials for “User1”.

p-0047Using the user service ticket in the described manner defers the need (for the login service <b>310</b> or the like) to know the login credentials of “User1” at the time the user service ticket <b>500</b> is issued. However, an encrypted part <b>510</b> of the user service ticket <b>500</b> may only be decrypted with a key derived from valid login credentials for “User1” thus facilitating authentication of the login credentials (by the login service <b>310</b> or the like) at a subsequent time such as in response to a login request.

p-0048<figref idrefs="DRAWINGS">FIG. 6</figref> is a flow chart diagram illustrating a credential validation method <b>600</b> of the present invention. As depicted, the credential validation method <b>600</b> includes receiving <b>610</b> one or more login credentials, testing <b>615</b> if an authentication service is available, authenticating <b>620</b> the user if the authentication service is available, or generating <b>630</b> a key from the login credentials and decrypting <b>640</b> (a portion of) a pre-fetched user service ticket corresponding to the user if the authentication service is unavailable. The depicted method also includes testing <b>645</b> if the login credentials were valid and approving <b>650</b> or denying <b>660</b> the login attempt.

p-0049Receiving <b>610</b> one or more login credentials may include receiving a username and password from a user attempting to login on a device such as a computer or a mobile device. Testing <b>615</b> if an authentication service is available may include attempting to locate a particular authentication server associated with the login device or testing for a timeout condition on an authentication request. In one embodiment, the authentication server is a Kerberos authentication server and a Kerberos ticket granting server such as the server <b>130</b> shown in <figref idrefs="DRAWINGS">FIG. 1</figref>.

p-0050Authenticating <b>620</b> the user if the authentication service is available may include communicating with the authentication server in a manner previously described in the description of <figref idrefs="DRAWINGS">FIG. 1</figref>. For example, an authentication request <b>162</b> may be sent to the authentication server <b>130</b> and a key generated from the user name and password may be used to decrypt a portion of the authentication reply <b>172</b> and ascertain if the login credentials are valid.

p-0051If the authentication service is unavailable, the depicted method <b>600</b> may generate <b>630</b> a key from the user's login credentials and decrypt <b>640</b> (a portion of) a stored user service ticket using a key generated from the user's login credentials. Furthermore, authentication data within the pre-fetched user service ticket may be compared with known data to confirm the validity of the pre-fetched ticket. Consequently, a user or group member may be authenticated regardless of the immediate availability of an authentication server.

p-0052Subsequent to executing steps <b>620</b> or <b>640</b>, the depicted method continues by testing <b>645</b> if the login credentials were valid and approving <b>650</b> or denying <b>660</b> the login attempt. Subsequently, the method ends <b>670</b>.

p-0053The present invention facilitates disconnected authentication of users without requiring a previous login. The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.